The demand for secure user authentication in computer networks, preferably for Internet services, is very high. Passwords are not very secure and might not fulfil the required security standards when personal data, bank accounts or health data have to be protected. Other solutions, like for example electronic tokens, are highly proprietary.
To overcome the problems in security and interoperability, the smartcard technology has been developed, combining standard compliance and very secure algorithms.
The use of smartcards for user authentication is considered to be a strong form of authentication and combines the use of something a user has, i.e. the smartcard, with something the user knows, e.g. a Personal Identification Number (PIN), to provide what is known as two-factor authentication. A smartcard is basically a small plastic card, about the size of a usual credit card, and typically contains a small embedded computer chip, i.e. a microchip, instead of the magnetic stripe provided in traditional credit cards. Smartcards are signature cards. Some of the certificates given on the smartcard are used for signing and some are used for authentication then.
It is known to provide an interactive smartcard login, as well as remote smartcard authentication. Users have the ability to access remote machines via their smartcard and interactively enter the PIN to login, just as if they physically walked up to the console of the remote machine. Remote smartcard authentication and interactive login do not require any type of smartcard middleware, and do not even require a smartcard reader attached to the remote machine.
For above mentioned reasons, smartcards are becoming more and more popular. Officials in several countries are thinking about issuing identity or authentication smartcards for their citizens. Furthermore, banks are issuing an increasing number of cards supporting digital signatures. Smartcards can be used for authentication in Internet services, e.g. in a way where the original issuer of a smartcard takes care of the authentication and then informs a service provider about the outcome of the authentication.
However, there are some problems in using smartcard authentication for services in the Internet. One reason is that most people use more than one computer for their sensitive transactions over the Internet. Therefore a smartcard reader has to be installed for each of the used computers. But even when a smartcard reader and the appropriate software are installed at each computer, a user does not know if the computer can be trusted or if sensitive data on the smartcard will be accessed unwantedly. Commercial certified smartcard readers are only certified for an environment trusted and controlled by the user.
It is an object of the invention to provide secure user authentication within a computer network, especially for the demand of Internet services. It is a further object of the invention to provide secure user authentication within a computer network, especially when performed on a non-trusted computer of the computer network.